Add explicit recursion limits to avoid stack overflows

[juntyr]

Fixes #307 and the long-standing potential for stack overflows while serialising or deserialising.

Now, ron::Options is by default configured for a recursion limit of 128 (here recursion is very loosely defined). This limit can be adjusted or disabled.

This bug was first reported by @5225225 in #307 and later by oss-fuzz.

This PR also slightly extends the from_str fuzz target to check serialising as well.

• I've included my change in CHANGELOG.md

[juntyr]

@torkleyy Does this API change look good to you? If so, feel free to squash and merge.

I would be surprised if anyone is using such highly recursive data structures in the wild and would be affected by the default limit. Hence, this might be a v0.9 change?

[codecov-commenter]

Codecov Report

Base: 93.06% // Head: 87.19% // Decreases project coverage by -5.86% ⚠️

Coverage data is based on head (ab9f879) compared to base (0c32f8d).
Patch coverage: 56.52% of modified lines in pull request are covered.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #420      +/-   ##
==========================================
- Coverage   93.06%   87.19%   -5.87%     
==========================================
  Files          56       57       +1     
  Lines        6618     7117     +499     
==========================================
+ Hits         6159     6206      +47     
- Misses        459      911     +452     

Impacted Files	Coverage Δ
src/error.rs	33.33% <0.00%> (-9.29%)	⬇️
tests/307_stack_overflow.rs	100.00% <ø> (ø)
src/options.rs	43.28% <5.55%> (-16.72%)	⬇️
src/ser/mod.rs	75.18% <64.58%> (-20.42%)	⬇️
src/de/mod.rs	71.31% <68.75%> (-22.22%)	⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

[juntyr]

Part of the codecov regression is spurious, part is expected. As I've spent the past few commits increasing codecov this is unfortunate, but I'll get to adding coverage for the stack overflow checks at some point :)

[juntyr]

@torkleyy As you might be busy, I will merge this PR on Friday if you don’t object. While this change would break deeply nested structures, I think this can be dealt with by pushing the change to 0.9 instead of 0.8.1. Apart from a new error, the API update is a non-breaking change.

[torkleyy]

Yes limiting the recursion limit is certainly useful especially for untrusted inputs. 👍